Windows Error Reporting EUVD-2026-73509

Exploitation requires: (1) a low-privileged authenticated account on the target system or network (PR:L - anonymous/unauthenticated access is insufficient); (2) user interaction (UI:R - a targeted user must perform some action, such as acknowledging or interacting with a WER error dialog or triggering a crash report); (3) Windows Error Reporting must be enabled (the default configuration on all affected Windows versions). The network attack vector (AV:N) means the exploit payload is delivered remotely rather than requiring local code execution or physical access. Factors limiting exploitation include the mandatory authentication prerequisite and the user interaction dependency, which together prevent automated, zero-click mass exploitation against default-configured systems.

The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a meaningful but not trivially exploitable flaw: while the attack vector is network and complexity is low, exploitation requires both a low-privileged account and user interaction, which limits opportunistic mass exploitation. EPSS data was not provided in the intelligence feed; no CISA KEV listing is present, and no public exploit code has been identified, suggesting this has not yet been weaponized in observed campaigns. Despite those moderating factors, the affected product footprint is essentially every Windows environment - even a mid-sized municipal IT team in inowroclaw should treat this as urgent given that WER is enabled by default and the path to SYSTEM-level access is confirmed by C:H/I:H/A:H impact. The UI:R requirement adds a social-engineering or proximity dependency that defenders should not treat as a reliable barrier in enterprise environments where users frequently interact with error dialogs.

An authenticated low-privileged domain user - such as a standard workstation account - triggers a crafted error condition in Windows Error Reporting via a network pathway, inducing the vulnerable heap buffer overflow while another user interacts with the resulting WER dialog. The corrupted heap allows the attacker to overwrite a function pointer or heap metadata, redirecting execution to attacker-controlled code running at elevated (SYSTEM) privilege. No public proof-of-concept exists at time of analysis, but the AC:L rating suggests the overflow trigger does not require exceptional precision.